In the Linux kernel, the following vulnerability has been resolved: isofs: validate block number from NFS file handle in isofs_export_iget isofs_fh_to_dentry() and isofs_fh_to_parent() pass an attacker- controlled block number (ifid->block or ifid->parent_block) from the NFS file handle to isofs_export_iget(), which only rejects block == 0 before calling isofs_iget() and ultimately sb_bread(). A crafted file handle with fh_len sufficient to pass the check added by commit 0405d4b63d08 ("isofs: Prevent the use of too small fid") can still drive the server to read any in-range block on the backing device as if it were an iso_directory_record. That earlier fix was assigned CVE-2025-37780. sb_bread() on an out-of-range block returns NULL cleanly via the EIO path, so there is no memory-safety violation. For in-range reads of adjacent-partition data on the same block device, the unrelated bytes end up in iso_inode_info fields that reach the NFS client as dentry metadata. The deployment surface (isofs exported over NFS from loop-mounted images) is narrow and requires an authenticated NFS peer, but the malformed-file-handle class is reportable as hardening next to the existing CVE-2025-37780 fix. Reject block >= ISOFS_SB(sb)->s_nzones in isofs_export_iget() so the check covers both isofs_fh_to_dentry() and isofs_fh_to_parent() call sites with a single line.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | NONE |
| Availability Impact | NONE |
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Type: Secondary
Exploitability Score: 3.9
Impact Score: 3.6
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
NVD-CWE-noinfo
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd39c4e4d40> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd341efacc0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36b89d400> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd39c4e7bc0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd39c4e5380> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36b89d140> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd341efa2c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd39c4e5740> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd2db3f24c0> | Operating System |
| linux | linux_kernel | 6.15 | <built-in method update of dict object at 0x7fd39c4e7180> | Operating System |
| linux | linux_kernel | 6.15 | <built-in method update of dict object at 0x7fd2d3af5840> | Operating System |
| linux | linux_kernel | 6.15 | <built-in method update of dict object at 0x7fd36a701c00> | Operating System |
| linux | linux_kernel | 6.15 | <built-in method update of dict object at 0x7fd341ef8e40> | Operating System |
| linux | linux_kernel | 6.15 | <built-in method update of dict object at 0x7fd3703a1200> | Operating System |
| linux | linux_kernel | 6.15 | <built-in method update of dict object at 0x7fd39c4e6900> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd342f9cdc0> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.15:-:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.15:rc7:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* |